Chapter 39 — Further Reading

Foundations (🔬 deeper)

• ISO/IEC 17024, Conformity assessment — General requirements for bodies operating certification of persons, and the ANAB (ANSI National Accreditation Board) overview of accredited personnel-certification programs. The standard that decides whether a credential is psychometrically sound or just a revenue product — and the exact thing a prepared cross-examiner asks about. Pair it with ISO/IEC 17025 (the lab standard) so you never blur the two on the stand.
• DoD Directive 8140 / Manual 8140.03 (the Cyber Workforce Qualification framework that supersedes DoD 8570) and the approved-baseline qualification lists. The primary source behind "is this cert required for the federal role?" Read which credentials map to which work roles before you spend a dollar chasing a government job.
• NIST/NICE Workforce Framework for Cybersecurity (NIST SP 800-181). How roles are decomposed into knowledge and skills — the scaffolding that explains why certs map to jobs the way the priorities matrix says they do.

Approachable explanations (everyone)

• Nelson, Phillips & Steuart, Guide to Computer Forensics and Investigations (Cengage) — the professional-development and certification chapters. A classroom-friendly tour of the credential landscape and how to plan a path, pitched at the newcomer.
• AboutDFIR (aboutdfir.com) and DFIR Diva (dfirdiva.com). The two best free resources for breaking in: AboutDFIR maintains a certification comparison and a jobs board; DFIR Diva curates free and low-cost training and explains the affordable path the chapter's career-changer actually walked.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 🔍 The issuing bodies themselves: IACIS (CFCE), ISFCE (CCE), and OpenText (EnCE). Read each program's current eligibility, process, cost, and renewal rules from the source — they change yearly, and verifying them is professional diligence.
• 🛡️ The GIAC certification roadmap and renewal handbook, plus SANS work-study and scholarship programs (sans.org/giac). The map of GCFE/GCFA/GNFA/GREM/GCFR, the open-book exam format, the 4-year/36-CPE renewal, and the discounts that make the expensive path affordable.
• 🛡️ The DFIR community as a living curriculum: This Week in 4n6, 13Cubed (free Windows-artifact deep-dives), Forensic Focus, and the r/computerforensics / r/dfir communities — where new artifacts are documented long before they reach an exam pool.
• 🔍🛡️ The CTFs: Magnet (Weekly/Summit), Cellebrite, and Belkasoft, worked against the free datasets in NIST CFReDS and Digital Corpora (Lone Wolf, M57-Patents). Portfolio gold and the best practical study there is.
• 📜 Relativity (RCA/RCE) and ACEDS (CEDS) program pages. If your path bends to litigation support, these — not EnCE or GCFA — are the letters that get you hired.
• 💾 ACE Lab (PC-3000), DeepSpar, Rusolut, and Teel Technologies course catalogs. The capability training that is the recovery world's real "certification" — chip-off, JTAG/ISP, NAND, and firmware repair.

Reference (this book)

• Appendix I — Certification Roadmap: EnCE, GCFE/GCFA/GNFA, CCE, CFCE, CHFI on one page, with how to document each.
• Appendix J — Practice Images and Lab Setup and Appendix B — Python Forensics Toolkit: the datasets and code that become your study lab and your portfolio.
• Chapter 27 — Expert Testimony: why your CV is sworn evidence. Chapter 13 — The Data Recovery Business: the un-certified world of recovery. Chapter 37 — Building a Forensic Lab: the lab you study in.

Do, don't just read

• Build your one-path cost table. Pick a single column from the priorities matrix, look up the current real cost and renewal burden of its two or three credentials, and write next to each how you would fund it. That number is your plan; an aspirational list of ten certs is a daydream.
• Start the portfolio today. Download a free practice image (Appendix J), verify its published hash, work a copy end to end, and publish a sanitized write-up. One write-up outranks one more acronym.
• Enter a CTF this quarter and stand up the tracker. Register for the next Magnet or Cellebrite CTF, and build the certification/CPE tracker (the spreadsheet or the Python sketch from the chapter) so that "current" is something you can prove, not something you "believe."

Next: Chapter 40 — The Forensics and Recovery Career: the roles, specializations, and the long arc from first job to expert and leader — building the career on top of the credentials and the development plan you just drafted.